About aimcplist's scanning traffic

§1What this is

If you run an MCP server and noticed a connection from a client identifying itself as:

that's us. aimcplist publishes a safety-graded directory of MCP servers (see our methodology) — this is the automated part of that grading pipeline connecting to your server to run a security scan.

§2What the scan actually does

It lists your server's available tools and their descriptions, then runs static analysis against that metadata (pattern-matching for known attack signatures like tool poisoning and prompt injection). It does not attempt to authenticate as a user, does not try to modify any data, and does not run arbitrary tool calls beyond what's needed to enumerate what your server exposes.

§3How often, and how much

Scans run on a nightly schedule, not continuously — a single pass per server, per night, at most. Traffic to any one server is rate-limited at the network level, so even a retry or a scheduling overlap can't turn into a burst against your server.

§4If you want it to stop, or something looks wrong

Verified maintainers can raise this through our dispute process — the same intake used for disputing a finding covers questions about the scan itself. See verifying as a maintainer for how to establish that it's really you.